N-ITSS_PWS_Task_Order_2_GSP.pdf

PERFORMANCE WORK STATEMENT (PWS)

Name: NASIC IT Support Services Persistent Infrared Analysis Squadron (GSP) – Task Order 2

Organization: National Air & Space Intelligence Center

Address: 4180 Watson Way, Wright-Patterson AFB, OH 45433

1 PURPOSE

The National Air and Space Intelligence Center (NASIC) is the source for air and space intelligence. NASIC produces integrated, predictive air and space intelligence to enable military operations, force modernization and national policymaking.

The Persistent Infrared Analysis Squadron (GSP) at the National Air and Space Intelligence Center (NASIC) is responsible for the maintenance, sustainment, and development of the Modular Persistence GEOINT (MPG) hardware, software, and databases. The MPG hardware, software, and databases support capabilities for the National Systems for Geospatial-Intelligence (NSG). The Persistent Infrared Analysis Squadron is located at the National Air and Space Intelligence Center, Wright-Patterson AFB (WPAFB), Fairborn, OH.

2 SCOPE

All work shall be performed at Wright Patterson Air Force Base (WPAFB), Fairborn, Ohio. The majority of work that shall be provided will occur at one of NASIC’s facilities at WPAFB. On-site support shall also be required at other locations on WPAFB. Many of the Center’s buildings are multi-story structures.

This effort includes maintenance fixes to ensure the proper function and maintain the Information Manager (IFM) hardware, which is on a system that crosses multiple networks (including JWICS, SIPRNet, NIPRNet, StoneGhost, Tungsten, and Zinc) and ~500+ Windows/Unix/Linux servers of varying brands, both physical and virtual. The effort includes network hardware and circuit management support, servers, virtualization and storage support, and heavy scripting and light database administration support.

The contractor shall also support and sustain customized, locally-developed, Government-provided software. The contractor shall provide support as detailed in this PWS on a flexible 24x7 schedule to maintain availability of the supported systems for 24x7 operations. Primary hours of support shall be 0600 – 2200, Monday through Friday. Support may be necessary outside of the primary hours in order to support crisis or high profile events, as well as to ensure that NSG operations are not negatively impacted by software system issues such as updates or fixes/patches. Due to the type of work being performed, the Government anticipates that all work shall be accomplished on-site at NASIC. The contractor shall operate 24/7 and 365 days per year and support over 400 government and contractor employees including nearly 180 analysts. The MPG environment includes over 200 physical and virtual servers, 2 PB of disk storage, 14 PB of tape storage, 200+ high-performance workstations, 10 million pages of OPIR Search – data and product dissemination web services.

The MPG areas of support include Active Directory, Red Hat Enterprise Linux (RHEL), Windows System Update Server (WSUS), SQL server 2005/2008/2012, SharePoint, Microsoft System Center Configuration Manager (SCCM).

The contractor shall comply with NASIC policies, processes, procedures, TCNO/IAVA and ICVA directives and national and local security rules, regulations and requirements;

specific instances waived by COR or QAP shall not be included.

All contracted support personnel shall have a TS/SCI security clearance with an up-to-date (having been completed no longer than five years prior to contract award) Single Source Background Investigation (SSBI). Selected contractor personnel may be required to satisfy a Counter Intelligence polygraph requirement. Certain contractor personnel shall also satisfy additional security requirements as detailed in para 7. All contracted support personnel shall possess and maintain Information Assurance Technical (IAT) Level II certification as required by DoD Directive 8570.01-M for the work being performed (Security+ requirement).

3 REQUIREMENT(S)/DESCRIPTION OF SERVICE(S)

3.1 GSP Helpdesk Support

3.1.1 Scope (in addition to the enterprise scope detailed above) Contractor shall be the single point of contact for all IT related issues for both internal and external customers Contractor shall provide tier 1 & 2 support Contractor shall create helpdesk tickets upon request through Atlassian JIRA Contractor shall diagnose and resolve technical and end-user problems in a customer service oriented, team environment (estimated work load: ~300 customers, ~200-300 help desk tickets per month, approximately 5 networks)

Contractor shall utilize the GSP ticket tracking system to track, document, and coordinate actions to members of the team

Contractor shall assist with Accounts Management Contractor shall provide 24 hour network resource/environmental monitoring and alarm reporting

3.1.2 Qualifications

Contractor shall have a minimum of three years of Microsoft or Linux administration and network infrastructure

Contractor shall have the ability to lift up to 40 pounds Contractor shall possess a proven ability to balance, prioritize, and organize multiple tasks Contractor shall possess a proven ability to resolve problems efficiently and effectively while recognizing customers’ competence levels and approaching each level appropriately

3.1.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures

Contractor shall follow the written and verbal instructions provided by the Government Task Manager, Branch/Flight Chief and/or Principal Technical Advisor (PTA)

Contractor shall coordinated corrective action required by outside/parent agencies as required

Contractor shall be responsible for monitoring, opening, assigning, updating and closing help desk tickets

Contractor shall troubleshoot assigned tickets using Standard Operating Procedures (SOP’s)

Contractor shall provide administrative support for GSP Networks as required such as granting/revoking network access and file permissions; performing file/directory restorations; installation of desktop software

Contractor shall provide administrative support to user account creation and maintenance to include resetting account passwords and unlocking accounts

Contractor shall provide desktop support at the customer’s location as required;

desktop support includes Windows and Unix/Linux workstations and mobile computing (i.e. laptops and tablets)

Contractor shall provide 24-hour network and environmental monitoring and appropriate alarm reporting utilizing NASIC-provided tools/capabilities

Contractor shall use Solarwinds to monitor and support various networks and system assets

Contractor shall perform documented system reboots in the data center as required

Contractor shall interact with other team members and back office (Tier II) personnel to determine corrective action

Contractor shall be able to utilize standard Active Directory and UNIX based commands

Contractor shall replace workstations with like systems and reload all applicable user applications

Contractor shall coordinate with other duty sections such as hardware technicians and software administrators when additional Tier II or Tier III support is required

Contractor shall notify personnel of facility alarms to dispatch maintenance individuals

Contractor shall follow VERITAS' backup/restoration Standard Operating Procedures

Contractor shall physically or remotely log into the system and execute prepackaged Microsoft Installers (MSIs) or follow prescribed flowcharts/checklists

Contractor shall provide Trusted Agent (TA) PKI support as requested Contractor shall provide daily network status reports Contractor shall install desktop software as required Contractor shall provide bulk data transfers between networks Contractor shall provide weekly functional area reports summarizing work accomplished, work planned in next week and important issues occurring during the week

3.2 Network Administration (Network Hardware Support)

3.2.1 Scope (in addition to the enterprise scope detailed above)

Contractor shall provide core hour support Contractor shall provide non-core hour support on an on-call basis and as approved by Contracting Officer Representative (COR) Contractor shall be required to install and maintain approximately 2 miles of network cabling per year Enterprise contains approximately 2,000 fiber terminations Enterprise contains over 500 network connections Contractor shall install and maintain premises network cabling throughout NASIC enterprise to include outlying buildings (estimated work load: ~500 GSP customers ~2,000 fiber-connected desktops, ~2000 desktop moves requiring fiber work per year, ~5 help desk tickets per month; over 300 miles of premises fiber cabling; historic hours of work is 400 hours per year)

3.2.2 Qualifications

Personnel shall possess Certified Fiber Optics Installer (CFOI) certification Contractor shall be capable of climbing ladders, lifting/carrying up to 40 pounds

3.2.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall install and maintain network cabling throughout NASIC enterprise to include outlying buildings Contractor shall install router/switches Contractor shall install, maintain, computer interconnects (Ethernet, InfiniBand, Fibre Channel) Contractor shall remove unused network cabling and equipment Contractor shall label all installations in accordance with NASIC guidance Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance; tools utilized shall include AutoCAD and MS Visio

Contractor shall design networks, schedule installations and schedule network maintenance

Contractor shall maintain list of equipment associated with this functional area Contractor shall provide weekly functional area reports summarizing work

3.3 Hardware Technician (Desktops and Peripherals)

3.3.1 Scope (in addition to the enterprise scope detailed above)

Contractor shall provide non-core hour support on an on-call basis and as approved by Contracting Officer Representative (COR) or Quality Assurance Personnel (QAP).

Contractor shall be required to install approximately 100 workstations per year Equipment to be installed/maintained includes Dell, HP, Oracle/Sun, and IBM desktop/workstations/servers which includes Microsoft Windows, Red Hat Enterprise Linux, and CentOS OSes; other systems to be supported are, printers, multi-function devices, and Zenoss network/server management.

Increase in servers to be supported due to specific mission area is approximately 50-100 physical and virtual servers per year

High-end workstations to be supported due to specific mission area is approximately 200 workstations

3.3.2 Qualifications

Contractor shall possess appropriate certifications from equipment vendors or their designated parties

3.3.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall install/maintain/repair/remove Windows/Unix/Linux workstations and servers Contractor shall install/maintain/repair/remove scanners, fax machines, network printers, multi-function devices, copiers, other devices Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance Contractor shall provide computer inventory and accountability support in accordance with customer prescribed practices with minimal supervision Contractor shall develop, maintain and execute server preventative maintenance scheduling Contractor shall maintain list of equipment associated with this functional area Contractor shall provide weekly functional area reports summarizing work

3.4 System Administration (Windows)

3.4.1 Scope (in addition to the enterprise scope detailed above)

Contractor shall provide non-core hour support on an on-call basis and as approved by COR or QAP Contractor shall provide Tier III support Enterprise includes roaming Windows profiles for approximately 350+ personnel Enterprise includes Windows 7 and 8 desktop operating systems (OS) Enterprise programs and applications to be supported are VMWare ESX, Exchange 2007/2010/2013 Server, SQL server 2005/2008/2012, SharePoint, SCCM, SMS, WSUS, Flexira AdminStudio, Windows Server 2003/2008/2012, Citrix, Windows Terminal Services, Hummingbird, Samba, Quest Vintela Authentication Services, MS Cluster Services, Active Directory, Symantec Antivirus Server, McAfee Antivirus Server, Microsoft Office Suite including Visio, Project. Internet Information Server, Admin Studio, Multimedia Message (M3) client, ESRI ArcGIS, Analyst Notebook, Adobe products, Lotus Notes and various scripting languages including Perl, Python, Bash, PowerShell, VB Script

Enterprise maintains operating system versions as required by DoD, NGA, and

USAF

3.4.2 Qualifications

Contractor shall possess appropriate certifications from equipment vendors or their designated parties

3.4.3 Description

Contractor shall follow all approved DoD and NASIC policies, processes and procedures

Contractor shall perform forensic analysis of security incidents and other malicious events as required

Contractor shall perform Certificate to Operate (CTO) testing and produce test result reports in accordance with provided guidance

Contractor shall conduct period audit reviews IAW NASIC, DoD, AF, and NGA guidance

Contractor shall provide/maintain Windows server builds IAW NASIC processes and policies

Contractor shall maintain/administer/update Windows operating systems, products, applications and services

Contractor shall maintain configuration management controls, to include security/update patches

Contractor shall provide Tier III support Contractor shall manage, configure, patch, support, and troubleshoot SCCM Contractor shall conduct periodic log reviews Contractor shall create/maintain custom ad hoc scripting Contractor shall maintain and administer Windows Terminal Services/Citrix Contractor shall provide production network integration services Contractor shall provide weekly performance, utilization and capacity reports Contractor shall manage and administer Microsoft SQL database services Contractor shall develop change plans for all Windows Enterprise/Domain modifications Contractor shall maintain Active Directory and associated custom scripting for account validation, office symbol changes and GPOs Contractor shall maintain Domain Name Service configuration integrated across

Windows/Linux Contractor shall create, modify, and manage user accounts, computer accounts, security groups and security policies Contractor shall Manage and monitor replication Contractor shall ensure the proper assignment and configuration of operations master roles Contractor shall configure and manage Lightweight Directory Access Protocol

(LDAP) settings Contractor shall monitor, patch, configure, and troubleshoot Windows servers Contractor shall support applications and services that uses common network protocols and services within the TCP/IP stack, such as DNS, SMTP, FTP, SFTP, SSH, etc

Contractor shall assign privileges, maintain, and troubleshoot systems and software problems

Contractor shall configure hardware and software for servers, RAIDs, storage arrays, and library storage devices

Contractor shall establish new user accounts, assigns privileges, and maintains system security, troubleshoots system and software problems

Contractor shall provide supervision and oversight across a wide array of Operational Systems and Projects – includes systems administration, integration, the establishing of new user accounts

Contractor shall interface with site Help Desk and trouble reporting system Contractor shall provide direct customer support on specified supported NGA architecture and systems

Contractor shall monitor system usage and perform system tuning Contractor shall maintain current technical competencies to recommend appropriate system upgrades Contractor shall provide functions such as hard drive removal, print server configuration, performance optimization, support printers, and storage peripherals

Contractor shall update software procedures to validate the software requirements specs

Contractor shall provide software related support to customer Contractor shall assist in hardware/software integration Contractor shall investigate vendor vulnerability updates and patches and create/modify scripting to assure system configuration compatibilities Contractor shall manage and enhance virtual machine containers Contractor shall create, configure, maintain, patch, and troubleshoot virtual systems under VMware and Citrix architectures Contractor shall provide highly-available, fault tolerant file/print cluster services Contractor shall maintain print services: drivers, spooler, separator pages, printer configuration Contractor shall configure/maintain Windows attached storage Contractor shall maintain TCP/IP configuration controls Contractor shall support installation/admin/update of antivirus software, server and signatures Contractor shall maintain/administer/update Windows products, applications and services Contractor shall maintain/administer/update approved third party Windows applications Contractor shall provide support for MS and third party application workstation products Contractor shall provide compliance with USAF/DIA directives, including but not limited to Time Compliance Network Orders (TCNO), Information Assurance Vulnerability Alerts (IAVA) and Intelligence Community Vulnerability Alerts (ICVA)

Contractor shall install/maintain security/update patches Contractor shall support in investigating, analyzing, correcting, and testing software related issues where applicable Contractor shall ensure compliance with computer security policy Contractor shall participate in technical exchanges Contractor shall provide weekly functional area reports summarizing work accomplished, work planned in next week and important issues occurring during the week

Contractor shall provide/maintain functional utilization reports, scorecards, databases

Contractor shall maintain and track user access Contractor shall monitor the enterprise daily for proper operation, performs routine system preventative and restorative Contractor shall establish and update procedures and documentation and performing daily system monitoring and maintenance

Contractor shall establish and update procedures and documentation and performs daily system monitoring and maintenance, data backup and restoration, data processing utilities, shell scripting, batch processing, security log audits, creation and deployment of server and workstation images

Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance; tools utilized shall include AutoCAD and MS Visio

3.5 System Administration (Unix/Linux)

3.5.1 Scope (in addition to the enterprise scope detailed above)

Contractor shall provide non-core hour support on an on-call basis and as approved by the COR or QAP Contractor shall provide Tier III support Enterprise includes primarily Red Hat Enterprise Linux (RHEL), CentOS, and

Solaris/UNIX Enterprise includes programs and applications that are a part of the RHEL workstation and server suite. Application Quest Vintela Authentication Services, Red Hat Satellite Server, Zenoss Enterprise Network Modeling, Oracle, BMC/Remedy, Jumpstart, NetBackup, StorNext HSM, Veritas HSM, Veritas Clusters, ZFS, VMWare, Kernel Virtual Machine (KVM), Virtual Box, Samba, Apache, Tomcat, Netscape, Oracle Web Services, ISSE Guard, eXmeritus, SeaMonkey, Thunderbird, Firefox, Chrome, Adobe, MATLAB cluster, Multimedia Message (M3) server, Symantec, Secure Messaging and Routing Terminal Server (Smart) and Smart.neXt, VMWare ESX and Consolidated Backup Server, YUM repositories, Cisco firewalls, Open Office, Libra Office, Lotus Notes, and programming/scripting languages Python, C, C++, C#, Bash, Perl, and Java

Enterprise maintains operating system versions as required by DoD and USAF Enterprise includes services the NASIC enterprise message system and electronic records management

3.5.2 Qualifications

Contractor shall possess appropriate certifications from equipment vendors or their designated parties

3.5.3 Description

Contractor shall interface with site Help Desk and trouble reporting system Contractor shall assign privileges, maintain, and troubleshoot systems and software problems Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall perform Certificate to Operate (CTO) testing and produce test result reports in accordance with provided guidance Contractor shall perform forensic analysis of security incidents and other malicious events as required Contractor shall conduct period audit reviews IAW NASIC and DoD guidance Contractor shall provide/maintain FDCC compliant workstation builds IAW NASIC processes and policies Contractor shall provide/maintain Windows server builds IAW NASIC processes and policies Contractor shall follow all approved DoD and NASIC policies, processes and procedures Contractor shall assist in hardware/software integration Contractor shall configure hardware and software for servers, RAIDs, storage arrays, and library storage devices

Contractor shall create, configure, maintain, patch, and troubleshoot virtual systems under VMware and Citrix architectures

Contractor shall create, modify, and manage user accounts, computer accounts, security groups and security policies

Contractor shall create/maintain custom ad hoc scripting Contractor shall develop change plans for all Unix/Linux modifications Contractor shall develop change plans for all Windows Enterprise/Domain modifications Contractor shall ensure the proper assignment and configuration of operations master roles Contractor shall maintain Domain Name Service configuration integrated across

Windows/Linux Contractor shall maintain configuration management controls, to include security/update patches Contractor shall maintain TCP/IP configuration controls, to include security/update patches Contractor shall maintain/administer/update approved third party Unix/Linux applications Contractor shall maintain/administer/update Unix/Linux operating systems, products, applications and services Contractor shall maintain/administer/update Windows operating systems, products, applications and services Contractor shall have administer services that utilize applications and services that uses common network protocols and services within the TCP/IP stack, such as DNS, SMTP, FTP, SFTP, SSH, etc

Contractor shall conduct periodic log reviews Contractor shall configure and manage Lightweight Directory Access Protocol

(LDAP) settings Contractor shall establish new user accounts, assigns privileges, and maintains system security, troubleshoots system and software problems Contractor shall provide/maintain server builds Contractor shall administer Red Hat LINUX or other RPM-based distributions of

LINUX

Contractor shall administer BIND DNS, FTP, and NTP as required Contractor shall configure directory service parameters Contractor shall maintain/update custom Samba services Contractor shall maintain/update JumpStart server/workstation builds Contractor shall maintain/update programming/scripting languages and libraries Contractor shall maintain/update/administer cross domain systems when necessary Contractor shall manage and enhance virtual machine containers Contractor shall manage and monitor replication Contractor shall manage group shares and home directories Contractor shall monitor system usage and perform system tuning Contractor shall monitor, patch, configure, and troubleshoot Linux servers Contractor shall provide Tier III support Contractor shall provide weekly performance, utilization and capacity reports Contractor shall provide network integration services Contractor shall provide production network integration services

Contractor shall provide software related support to customer Contractor shall build/maintain/administer license servers Contractor shall perform software loading and configuration controls Contractor shall maintain print services: drivers, spooler, separator pages, printer configuration Contractor shall configure/maintain Windows attached storage Contractor shall maintain TCP/IP configuration controls Contractor shall maintain/administer/update Windows products, applications and services Contractor shall provide support for MS and third party application workstation products Contractor shall provide support for OS and third party application workstation products Contractor shall support installation/admin/update of antivirus software, server and signatures Contractor shall provide highly-available, fault tolerant file/print cluster services Contractor shall participate in technical exchanges Contractor shall ensure compliance with computer security policy Contractor shall provide compliance with USAF/DIA directives, including but not limited to Time Compliance Network Orders (TCNO), Information Assurance Vulnerability Alerts (IAVA) and Intelligence Community Vulnerability Alerts

(ICVA).

Contractor shall support in investigating, analyzing, correcting, and testing software related issues where applicable

Contractor shall install/maintain security/update patches Contractor shall maintain and tracks user access Contractor shall provide/maintain functional utilization reports, scorecards, databases Contractor shall provide weekly functional area reports summarizing work accomplished, work planned in next week and important issues occurring during the week

Contractor shall establish and update procedures and documentation and performs daily system monitoring and maintenance, data backup and restoration, data processing utilities, shell scripting, batch processing, security log audits, creation and deployment of server and workstation images

Contractor shall maintain and track user access Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance; tools utilized shall include AutoCAD and MS Visio

Contractor shall monitor the enterprise daily for proper operation, performs routine system preventative and restorative Contractor shall establish and update procedures and documentation and performing daily system monitoring and maintenance

3.6 Storage and Backup Administration

3.6.1 Scope (in addition to the enterprise scope detailed above) approved by COR or QAP

Enterprise includes equipment, systems and software Brocade, Hitachi, Dell, Oracle (Sun), Quantum, StorNext, AMS, NetBackup, Device Manager

Increase in storage to be supported due to specific mission area is approximately 150 terabytes of disk storage and 6-8 PB of tape storage per year

3.6.2 Qualifications

Contractor shall have received specialized training in Hitachi, Brocade, and Dell storage devices

3.6.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall provide functional utilization reports as requested Contractor shall provide network integration services Contractor shall perform configuration/administration of SAN devices and resources Contractor shall update the microcode/firmware on SAN devices using Device

Manager, and High Command application tools Contractor shall perform installation, configuration and maintenance of the

Brocade SAN switches including the DCX, VDX, and ICX series Contractor shall perform installation, configuration, and maintenance of all

Brocade SAN switches of the DCX, VDX, and ICX series including the 8500, 6500, 48K, 4100, 3900 series

Contractor shall perform SAN/Enterprise Disk Administration Performing installation, configuration and maintenance of all Hitachi HNAS, HUS, VSP, and AMS storage systems

Contractor shall perform all installation, configuration, and maintenance of all Hitachi Data Storage Network Attached Storage systems

Contractor shall perform all installation, configuration and maintenance of all Hitachi storage including Hitachi Unified Storage (HUS), Virtual Storage Pool (VSP), Hitachi Network Attached Storage (HNAS), and Adaptable Modular Storage (AMS) systems

Contractor shall perform installation, configuration, and maintenance of all Dell Compellent SC8000 and SC200 series

Contractor shall provide all installation, configuration, and maintenance of all enterprise tape backup storage system including the following libraries: Quantum Scalar AEL 6000, i6000, i2000, and i500

Contractor shall install and updated licenses for adding more storage and domains to current and new Hitachi storage systems

Contractor shall install/configure/administer Symantec Netbackup backups/restores

Contractor shall perform enterprise backups and Tier III data file restores, configuration, and troubleshooting

Contractor shall provide corrective and preventative maintenance on all tape libraries and storage sub-systems

Contractor shall perform all configuration and administration of Quantum enterprise tape backup storage and recovery system, including Quantum libraries Scalar series

Contractor shall perform regular data restoration tests of various pieces of data from different backups to ensure integrity of the backup

Contractor shall provide weekly functional area reports summarizing work the week

Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance

Contractor shall maintain list of equipment associated with this functional area Contractor shall provide weekly performance, utilization and capacity reports Contractor shall follow NASIC Disaster Recovery Program (DRP) procedures

3.7 Systems Engineer

3.7.1 Scope (in addition to the enterprise scope detailed above)

Contractor shall provide non-core hour support on an on-call basis and as approved by Contracting Officer Representative (COR) Contractor shall provide state-of-the-art techniques for designing, developing, modifying and troubleshooting highly complex computer operating hardware system.

Subject matter expert on emerging technologies

3.7.2 Qualifications

Contractor shall possess a Master’s degree in this functional area, or have Bachelor’s and 5 years of experience, or 10+ years of experience directly involving Systems Engineering work. (e.g. information systems, computer science, math or engineering)

Contractor shall have vendor specific training/certifications in two or more areas of Windows, Linux, storage, networks, systems engineering, systems security, or computing cluster environments.

3.7.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall design operating/hardware systems Contractor shall formulate system concepts and architecture, specify requirements and develop implementation approaches Contractor shall identify and resolve complex hardware/software interface issues Contractor shall be the subject matter expert on emerging technologies Contractor shall direct the development of systems specifications and technical documentation Contractor shall provide functional utilization reports as requested Contractor shall provide network integration services Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance Contractor shall maintain list of equipment associated with this functional area Contractor shall provide weekly functional area reports summarizing work

3.8 Security Engineer Support

3.8.1 Scope (in addition to the enterprise scope detailed above) approved by Contracting Officer Representative (COR) Contractor shall provide expert support, analysis and research into exceptionally complex problems Contractor shall ensure that the architecture and design of information systems are functional and secure Contractor shall provide expert support for Information Technology in areas of information systems architecture, telecommunications systems design, architecture, implementation, information systems integration, software development, security engineering, and communications and network systems management

Contractor shall identify security issues and risks, and develop mitigation plans Contractor shall architect, design, implement, support, and evaluate security-focused tools and services including project leadership roles Contractor shall develop and interpret security policies and procedures Contractor shall mentor junior members of the team Contractor shall develop and deliver training materials and perform general security awareness and specific security technology training Contractor shall evaluate and recommend new and emerging security products and technologies Contractor shall participate in incident handling Contractor shall actively protect the availability, confidentiality, and integrity of customer, user, and mission information and data Contractor shall proactively instruct, update, maintain and manage, monitor, and support enterprise network and systems security operations infrastructure throughout the shared services environment

Contractor shall have experience and expertise with ethical hacking, firewall and intrusion detection/prevention technologies, secure coding practices and threat modeling

Contractor shall be proficient with Windows and Unix/Linux operating systems Contractor shall build, maintain, manage, and monitor the security infrastructure Contractor shall perform day to day administration of security related systems and applications, monitoring logs, and reporting of security events Contractor shall develop, enhance, and execute security operations processes Contractor shall proactively manage, tune, and troubleshoot security logging, web filtering, anti-malware, vulnerability management, and other security systems

Contractor shall provide security advice on directory services such as Active Directory and LDAP as well as operating system environments

Contractor shall monitor, analyze, and evaluate operations and activities to ensure an appropriate level of information protection is achieved and maintained

Contractor shall perform vulnerability assessments and assists IT operations with remediation planning

Contractor shall assists IT operations with remediation planning and implementations

Contractor shall participate in operations and tactical planning Contractor shall provide vulnerability and threat management monitoring and mitigation response

Contractor shall work with architects and senior engineers to review security architecture and design documents to ensure consistency, accuracy and compliance with the articulated security posture and industry requirements

Contractor shall have in-depth knowledge of network security best practices Contractor shall assist senior and lead Engineers in the review, development, testing and implementation of security plans, products and control techniques Contractor shall participate in tactical and operational planning of vulnerability assessment activities Contractor shall provide vulnerability and threat management monitoring and mitigation response Contractor shall incorporate stakeholders, the Information Security Teams, associated working groups, and external contacts within the information security industry

Contractor shall have knowledge of in designing secure network architectures, virtualization technologies, application security, DNS, and web applications

Contractor shall assist with architects and senior engineers and systems engineering team in designing, integrating, and deploying services, systems, and future capabilities

Contractor shall have knowledge of authentication protocols, core network and system security principles

3.8.2 Qualifications

Contractor shall possess within six months and maintain Information Assurance

Technical Level III (e.g. CISSP) certification as required by DoD Directive 8570.01-M for the work being performed

Contractor shall possess a Master’s degree in this functional area, or have Bachelor’s and 5 years of experience, or 8+ years of experience directly involving Security Engineering work. (e.g. information systems, computer science, math or engineering; certifications e.g CEH, ECSA, ENSA, ISSEP)

Contractor shall have vendor specific training/certifications in two or more areas of Windows, Linux, storage, networks, systems engineering, systems security, or computing cluster environments.

3.8.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall design and develop IA or IA enabled products, interface specifications, and approaches to secure the environment Contractor shall assess threats to the environment and provide input on security designs and architecture Contractor shall participate in risk assessment during the Accreditation and

Authorization (A&A) process Contractor shall provide weekly functional area reports summarizing work

3.9 Data Center Support Engineer

3.9.1 Scope (in addition to the enterprise scope detailed above) approved by the COR or QAP

Enterprise includes primarily Solaris 10, IRIX, Red Hat Linux, Red Hat Enterprise Linux (RHEL) and CentOS

Enterprise includes programs and applications that are in Microsoft Windows, RHEL, and NIS, DNS, Quest Vintela Authentication Services, Red Hat Satellite Server, Zenoss Enterprise Network Modeling, Oracle, BMC/Remedy, Jumpstart, NetBackup, StorNext HSM, Veritas HSM, Veritas Clusters, ZFS, VMWare, Kernel Virtual Machine (KVM), Virtual Box, Samba, Apache, Tomcat, Netscape, Oracle Web Services, ISSE Guard, eXmeritus, SeaMonkey, Thunderbird, Firefox, Chrome, Adobe, MATLAB cluster, Multimedia Message (M3) server, Symantec, Secure Messaging and Routing Terminal Server (Smart) and Smart.neXt, VMWare ESX and Consolidated Backup Server, YUM repositories, Cisco firewalls, Open Office, Libra Office, Docker, and various programming/scripting languages C, Python, Perl and Java.

Contractor shall develop, innovative, and implement complex computing solutions, ensuring that upgrades and changes comply with established guidelines and processes

Contractor shall further develop and execute computing solutions using cluster/grid technologies

Contractor shall serve as a senior member of the team responsible for the planning and development of a robust and scalable management infrastructure for Linux computing resources

Contractor shall have development experience in C, C++ and/or Java, PHP, JavaScript, Perl, Python

Contractor shall contribute to development of next-generation cluster-processing framework, algorithms, and tooling (using C++, OpenCL/CUDA, MATLAB, MPI, Pthreads)

Contractor shall have knowledge of network and web related protocols (eg, TCP/IP, UDP, HTTP, HTTPS, routing protocols)

Contractor shall be required advanced knowledge of complex concepts, practices and procedures associated with IT systems design, installation and maintenance

Contractor shall support, administer Red Hat Enterprise Linux (RHEL) systems within the compute environment

Contractor shall support, administer Windows systems within the compute environment

Contractor shall support, administer Citrix / VM Ware based remote access systems within the compute environment

Contractor shall have experience in cloud implementations using Amazon Web Services (AWS)

Contractor shall have expertise in cluster computing middleware installation, administration, security and patching

Contractor shall have experience with High-performance storage and distributed file systems

Contractor shall have experience with distributed object storage systems (e.g. S3

/ SWIFT)

Contractor shall have experience managing complex computing environments using Puppet, Chef, Ansible or Salt Stack

Contractor shall support container technology, container monitoring, and micro services

Contractor shall have experience with High-performance computer interconnects (Ethernet, InfiniBand, Fibre Channel)

Contractor shall be responsible for advanced level design, integration, implementation and modification of a wide variety of user information systems usually within a highly complex environment

Contractor shall coordinate installation, testing, operation, troubleshooting and maintenance of computer systems

Contractor shall provide functional and technical expertise in support of user systems operation and maintenance

Contractor shall have solid experience in MATLAB and toolboxes Contractor shall have knowledge in taking requirements or existing capabilities of existing MATLAB code and assist in tailoring to meet current or future needs Contractor shall conduct needs analysis, planning and scheduling the installation of a wide variety of new or modified hardware/software Contractor shall develop functional and technical IT system requirements and specifications Contractor shall provide technical support through allocating systems resources, managing accounts, administering passwords, documentation, security, recoverability and access including deploying security and operating system patches

Contractor shall support internal departmental servers Contractor shall maintain hardware and software inventories including developing and updating departmental distributed software license management policy Contractor shall enhance functional capabilities, performance, and robustness of the existing system Contractor shall have industry experience as a data engineer, with specific exposure to both unstructured and structured data environments Contractor shall troubleshoot OS, networking, storage, and software issues while leveraging internal teams for solutions Contractor shall deliver changes to the production platforms according to the change control process Communicating and seeking approvals from business owners

Contractor shall develop tools to deploy, manage, monitor and troubleshoot cluster computing systems at scale

Contractor shall maintain asset lists of all servers, applications and licensing ensuring compliancy

Contractor shall serve as a senior member of the team responsible for the planning and development of a robust and scalable management infrastructure for Linux computing resources

Contractor shall requires advanced knowledge of complex concepts, practices and procedures associated with IT systems design, installation and maintenance

Contractor shall have knowledge of network and web related protocols (eg, TCP/IP, UDP, HTTP, HTTPS, routing protocols)

Contractor shall industry experience as a data engineer, with specific exposure to both unstructured and structured data environments including knowledge of and experience with SQL and NOSQL data architectures, capabilities, tools and support requirements

Contractor shall conduct needs analysis, planning and scheduling the installation of a wide variety of new or modified hardware/software

Contractor shall develop functional and technical IT system requirements and specifications

Contractor shall responsible for advanced level design, integration, implementation and modification of a wide variety of user information systems usually within a highly complex environment

Contractor shall develop, innovative, and implement complex computing solutions, ensuring that upgrades and changes comply with established guidelines and processes

Contractor shall further develop and execute computing solutions using cluster/grid technologies

Contractor shall development experience in C, C++ and/or Java, PHP, JavaScript, Perl, Python, Javascript

Contractor shall contribute to development of next-generation HPC-based framework, algorithms, and tooling (using C++, OpenCL/CUDA, MATLAB, MPI, Pthreads)

Contractor shall develop tools to deploy, manage, monitor and troubleshoot HPC systems at scale

Contractor shall have solid experience in MATLAB and toolboxes and knowledge in taking requirements or existing capabilities of existing MATLAB code and assist in tailoring to meet current or future needs

3.9.2 Qualifications

Contractor shall possess appropriate certifications/training from equipment vendors or their designated parties

3.9.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall maintain/administer/update Unix/Linux operating systems, products, applications and services Contractor shall maintain/administer/update approved third party Unix/Linux applications Contractor shall develop change plans for all Unix/Linux modifications Contractor shall provide weekly functional area reports summarizing work accomplished, work planned in next week and important issues occurring during the month

Contractor shall provide weekly performance, utilization and capacity reports Contractor shall provide functional utilization reports as requested Contractor shall provide network integration services Contractor shall provide compliance with USAF/DIA directives, including but not limited to Time Compliance Network Orders (TCNO), Information Assurance Vulnerability Alerts (IAVA) and Intelligence Community Vulnerability Alerts (ICVA)

Contractor shall perform Certificate to Operate (CTO) testing and produce test result reports in accordance with provided guidance

Contractor shall maintain and tracks user access Contractor shall provide support for OS and third party application workstation products Contractor shall maintain TCP/IP configuration controls, to include security/update patches Contractor shall create/maintain custom ad hoc scripting Contractor shall maintain/update programming/scripting languages and libraries Contractor shall provide functional and technical expertise in support of user systems operation and maintenance

Contractor shall coordinate installation, testing, operation, troubleshooting and maintenance of compute systems

Contractor shall support, administer Red Hat Enterprise Linux (RHEL) systems within the compute environment

Contractor shall support, administer Windows systems within the compute environment

Contractor shall have experience in cloud implementations using OpenStack Contractor shall have expertise in HPC middleware installation, administration, security and patching Contractor shall have experience with High-performance storage and clustered file systems Contractor shall have experience with High-performance computer interconnects

(Ethernet, InfiniBand, Fibre Channel) Contractor shall provide technical support through allocating systems resources, managing accounts, administering passwords, documentation, security, recoverability and access including deploying security and operating system patches

Contractor shall monitor and report on system performance Contractor shall troubleshoot OS, networking, storage, and software issues while leveraging internal teams for solutions Contractor shall support internal departmental servers Contractor shall enhance functional capabilities, performance, and robustness of the existing system Contractor shall deliver changes to the HPC production platforms according to the change control process Communicating and seeking approvals from business owners

Contractor shall maintain hardware and software inventories including developing and updating departmental distributed software license management policy

4 Cyber Security The contractor shall ensure that all system or application deliverables meet the requirements of DoD and AF Information Assurance (IA) policy. Furthermore, the contractor shall ensure that personnel performing IA activities obtain, and remain current with, required technical and/or management certifications.

4.1 System IA

For those solutions that will not inherit existing network security controls, and thus integrate an entirely new application system consisting of a combination of hardware, firmware and software, system security assurance is required at all layers of the TCP/IP DoD Model. The contractor shall ensure that all system deliverables comply with DoD and AF IA policy, specifically DoDI 8500.2, Information Assurance Implementation, and AFI 33-200, Information Assurance Management. To ensure that IA policy is implemented correctly on systems, contractors shall ensure compliance with DoD and AF Certification & Accreditation policy, specifically DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), and AFI 33-210, Air Force Certification and Accreditation Process (AFCAP). The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.1.1 Application IA

For those solutions that will be deployed to Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or similar environments, and thus inherit existing network security controls, application security assurance is required at the Application layer of the TCP/IP DoD Model. The contractor shall ensure that all application deliverables adhere to Public Law 111-383, which states the general need for software assurance. Specifically, the contractor shall ensure that all application deliverables comply with the Defense Information Systems Agency (DISA) Application Security & Development Security Technical Implementation Guide (STIG), which includes the need for source code scanning, the DISA Database STIG, and a Web Penetration Test to mitigate vulnerabilities associated with SQL injections, cross-site scripting, and buffer overflows.

The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.1.2 Personnel IA

Personnel performing Information Assurance (IA) activities are required to obtain, and remain current with, technical and/or management certifications to ensure compliance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 (with all current changes).

5 CONTRACTUAL REQUIREMENTS

5.1 Place of…